I am writing a system where the user must log in with two passwords: a normal password (salted and hashed, stored in database), and a special password where the user needs to type only some letters, e.g. "please type the second, third and last letter of your password".
How can one design that system to support the second password?
Idea 1: store the password in plaintext. Of course not.
Idea 2: Store each character separately, salted and hashed. Bad because if the attacker knows the salt, it only takes a few dozen guesses to bruteforce the character.
Is there any other way?
The two passwords have to be typed at the same time, like so:
The purposes of the second password are:
- Defeat the attacker who looks over your shoulder while you type the password, or a keylogger.
- Defeat the password manager in your browser, when someone like your family member can log in to your account if you chose to save your password in the browser.
- Provide a simple alternative to 2FA when the user is not accessing extremely sensitive information, so we don't bother them to retrieve their hardware one-time password generator (which they also have).
Bcryptor similar functions with about a 100ms duration. The point is to make the attacker spend substantial of time finding passwords by brute force.